Cross-site Scripting
Multiple form validation endpoints in Jenkins Mango Runner Plugin do not escape values received from the useMango service, resulting in a cross-site scripting (XSS) vulnerability exploitable by users who are able to control the values returned from the useMango service.